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ABSTRACT 

Ares l-X was the designation given to the flight test version of the Ares I rocket which was developed 
by NASA (also known as the Crew Launch Vehicle (CLV) component of the Constellation Program). The 
Ares l-X flight test vehicle achieved a successful flight test on October 28, 2009, from Pad LC-39B at 
Kennedy Space Center, Florida (KSC). As part of the flight plan approval for the test vehicle, a range 
safety malfunction turn analysis was performed to support the risk assessment and vehicle destruct 
criteria development processes. Several vehicle failure scenarios were identified which could have 
caused the vehicle trajectory to deviate from its normal flight path. The effects of these failures were 
evaluated with an Ares l-X 6 degrees-of-freedom (6-DOF) digital simulation, using the Program to 
Optimize Simulated Trajectories Version II (POST2) simulation tool. The Ares l-X simulation analysis 
provided output files containing vehicle trajectory state information. These were used by other risk 
assessment and vehicle debris trajectory simulation tools to determine the risk to personnel and facilities 
in the vicinity of the launch area at KSC, and to develop the vehicle destruct criteria used by the flight test 
range safety officer in the event of a flight test anomaly of the vehicle. The simulation analysis approach 
used for this study is described, including descriptions of the failure modes which were considered and 
the underlying assumptions and ground rules of the study. 

INTRODUCTION 

This document describes a simulation trajectory study that was performed to support the flight plan 
approval process for the Ares l-X flight test vehicle, which achieved a successful flight test on October 28, 
2009, from launch pad LC-39B at Kennedy Space Center, Florida. This study, referred to as the 
“malfunction turn analysis," analyzed the effects of several vehicle failure modes which could have 
caused the vehicle trajectory to deviate from its normal flight path. The effects of these failures were 
evaluated with a 6 degrees-of-freedom digital simulation, using the Program to Optimize Simulated 
Trajectories Version II simulation framework. The simulation analysis approach used for this study is 
described, including descriptions of the failure modes which were considered. In addition, the underlying 
assumptions and ground rules of the study, as well as the independent verification and validation (IV&V) 
and quality assurance processes used to confirm the validity of the simulation trajectory predictions are 
discussed. 

The malfunction turn analysis was conducted in accordance with, and with the cooperation of, the 
NASA Launch Constellation Range Safety Panel (LCRSP) and its Range Safety Trajectory Working 
Group (RSTWG). Members of those organizations were composed of personnel from the following NASA 
centers: Johnson Space Center (JSC), Marshall Space Flight Center, Langley Research Center, 

Kennedy Space Center, Glenn Research Center, the United States Air Force 45 th Space Wing (45SW) at 
Patrick AFB, and their support contractors: United Space Alliance, LLC and Alliant TechSystems (a 
division of ATK Thiokol, Inc.). Much of the malfunction turn analysis was based on a similar analysis for 
the Space Shuttle, performed by JSC civil servant and contractor personnel in August, 2005 (Reference 
1 ). Similar descriptions of the malfunction turn analyses that were conducted for the Ares l-X preliminary 
flight data package are presented in References 2 and 3. 

The purpose of the malfunction turn analysis was to provide output files containing vehicle trajectory 
state information that would allow other NASA and Air Force range safety personnel to use independent 
risk assessment and vehicle debris trajectory simulation tools. These analyses would assess the risks to 
personnel and facilities in the immediate vicinity of KSC launch pad LC-39B, and establish vehicle 
destruct lines that would prevent vehicle debris from crossing impact limit lines, in the unlikely event of a 
flight test failure. The other Ares l-X flight test mission objectives were not a primary concern of the 
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malfunction turn analysis. This paper does not address other range safety analyses within the Ares l-X 
flight plan data package that were required to obtain final flight test approval for the October 28, 2009, 
flight test. 


RESULTS AND DISCUSSION 

The malfunction turn analysis considered the effects on the vehicle trajectory of several potential 
single-point vehicle failure modes consisting of legacy Space Shuttle failure modes, as well as Ares l-X 
vehicle-specific failure modes. A separate probabilistic risk assessment (PRA) process evaluated the 
proposed failure modes, and assigned a probability of occurrence to each. Dual failures were not 
considered for this analysis, because of the very low probability of multiple independent failures, unless 
their occurrence can be attributed to a common cause single failure mechanism. 

This malfunction turn analysis did not consider the probability of the failure modes that were 
considered, but provided only the vehicle response to each failure. The vehicle trajectory state data 
resulting from each failure was combined in other analyses with vehicle breakup debris models. The 
resulting data estimated the expected characteristics of the debris fragments, and with the failure 
probabilities generated by the PRA process, ultimately was used to estimate the expected number of 
casualties (E c ). The E c estimates were compared against public safety limits that are specified in NASA 
and 45SW requirements documents and were provided to the range safety personnel at the USAF 
Eastern Test Range as part of the flight data plan approval process required to launch the Ares l-X flight 
test vehicle from the Eastern Test Range at KSC. 

The malfunction turn analysis utilized a failure run matrix, in which each vehicle failure mode was 
initiated individually in separate simulation runs at two second intervals, starting at vehicle release from its 
launch pad hold-down mechanism and continuing until normal reusable solid rocket motor (RSRM) 
burnout. In each simulation case, the vehicle trajectory proceeded normally until the time that the failure 
was initiated, where it could depart from the normal flight path in response to the effects of the failure. In 
each failure case, the simulation continued until one of the following events occurred: normal burnout of 
the RSRM occurred (at approximately two minutes after launch), the vehicle impacted the earth’s surface, 
estimated vehicle structural breakup criteria were exceeded, or the time limit for the maximum failure 
duration was exceeded (selected failure modes only). 

The vehicle structural breakup model used a distributed aerodynamic model to compute the 
aerodynamic axial force and normal force and the RSRM thrust (both from its nozzle as well as from 
breaches, or openings, in the RSRM outer case during case breach failure cases) at each of the 26 joints 
along the flight test vehicle centerline longitudinal axis. The forces at each joint were used by the loads 
model to compute the structural running loads at each joint (compression axial line load, tension axial line 
load, and shear line load), which were compared against failure criteria to determine if one or more joints 
would fail following a malfunction turn failure. 

No attempt was made to propagate vehicle debris to ground impact during the malfunction turn 
analysis. Separate follow-on analyses using the vehicle trajectory state information provided by the 
malfunction turn analysis combined with the vehicle “debris catalog,” which defined the ballistic 
characteristics of vehicle debris resulting from vehicle structural break-up, determined the ground impact 
points of major parts of the vehicle for each failure case. 

The vehicle failure modes that were identified for the final malfunction turn analysis were: loss of 
thrust vector control (TVC), RSRM nozzle burn through, RSRM case breach, and software failures and 
anomalies. Each of these failure modes is described in detail in the following sections. Earlier 
malfunction turn analyses that were provided for the preliminary flight data package range safety 
analyses also included loss of vehicle roll control failures. However, subsequent simulation analyses of 
those failures revealed that they do not cause significant trajectory deviations of the vehicle, compared 
with its nominal trajectory, so that loss of vehicle roll control failures were eliminated from the final 
malfunction turn trajectory analysis. 
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LOSS OF THRUST VECTOR CONTROL 


The loss of thrust vector control (TVC) failure modes consisted of two different types of failures, both 
of which could be caused by single-point failures: single failures of the individual actuators of the system 
that rotates the RSRM nozzle to vector the thrust in response to flight control system commands, and 
simultaneous failures of both RSRM nozzle actuators caused by a common cause failure of the two 
auxiliary power units (APU) that provide power to the actuators. The rotation of the RSRM nozzle to 
vector the thrust is achieved by two linear actuators that are positioned at 45° angles to the vehicle body 
frame pitch and yaw axes. Figure 1 shows a sketch of the orientation of the two actuators, from the 
perspective of an observer looking from the bottom of the vehicle toward its top, with the vehicle body 
frame Y B axis shown to the right and its Z B axis shown downward. The vehicle body reference frame 
origin is located at the instantaneous vehicle center of mass, with its X B axis parallel to the vehicle axis of 
symmetry and pointing toward the front (top) of the vehicle, its Y B axis pointing to the right (from the 
perspective of the crew members in the in the Ares I, or CLV, operational version of the Ares l-X), and its 
Z B axis completing a right handed coordinate system (the Z B axis points opposite the heads-up direction 
of crew members). 



Figure 1 Tilt and Rock TVC Actuator Orientation 


Extension of the tilt actuator (which is defined as positive tilt deflection of the RSRM motor nozzle) 
pushes the RSRM nozzle up and to the right (as viewed from the perspective shown in Figure 1 at the aft 
end of the vehicle with its body frame y-axis pointing to the right and its z-axis pointing down), which 
produces a component of the thrust that is perpendicular to the vehicle axis of symmetry and points down 
and to the left (again, relative to the view depicted by Figure 1). Extension of the tilt actuator (positive tilt 
deflection of the nozzle) causes vehicle pitch up and yaw right thrust moments to be applied about the 
vehicle center of mass in its body frame axes. Extension of the rock actuator (which is defined as positive 
rock deflection) pushes the RSRM nozzle down and to the right (as viewed from the perspective shown in 
Figure 1 at the aft end of the vehicle with its body frame y-axis pointing to the right and its z-axis pointing 
down), which produces a component of the thrust that is perpendicular to the vehicle axis of symmetry 
and points up and to the left (again, relative to the view depicted by Figure 1). Extension of the rock 
actuator (positive rock deflection of the nozzle) causes vehicle pitch down and yaw right thrust moments 
to be applied about the vehicle center of mass in its vehicle body frame axes. 

The hardware failure modes associated with the RSRM nozzle actuators include: single axis failures of 
the tilt or rock actuator and dual axis failures. In the single axis failures, the failed actuator moves to the 
actuator physical deflection limit of +5 or -5 degrees, to its null position (0 degrees), or the actuator fails 
in-place (in which the actuator stops responding, and maintains its deflection at the time of the failure), 
while the remaining actuator continues to function normally. Dual actuator failures could be caused by a 
common cause failure affecting both actuators, such as APU failures, which cause both actuators to fail 


3 


in-place; that is, they remain at their deflections at the time of the failure. Separate software failure modes 
that could cause the actuator command to lock in place, command hard over or zero deflection were also 
considered, and are described in a later section of this document. 

The deflections used for the in-place failure mode actuator failures were based on the actuator 
deflection time history from a Monte Carlo analysis of the baseline Ares l-X trajectory with no failures and 
an optimization analysis. The optimization analysis defined the TVC deflections at each failure time that 
resulted in the worst (greatest) deviation of the malfunction turn instantaneous vacuum impact point (IIP) 
from the nominal IIP at 4 seconds after the failure initiation (as requested by personnel from the 45SW). 
The Monte Carlo analysis established a statistical distribution of the rock and tilt deflection as a function 
of time. 

Figure 2 shows a sample of maximum rock and tilt axis deflections from 2000 cases of a Monte Carlo 
simulation. The probability of occurrence at each deflection angle between the minimum and maximum 
values was computed from the statistics of the 2000 deflections at that failure time. For each time in the 
run matrix, lock in place failures were simulated at the mean deflection, and in increments of one 
standard deviation from the mean to plus and minus three standard deviations and at the deflection 
causing the greatest deviation from the nominal IIP as determined by the optimization study. 



Figure 2 Monte Carlo Rock & Tilt Deflection Limits 


RSRM NOZZLE BURN THROUGH FAILURE 


A description of the RSRM nozzle burn through failure mode is provided in Reference 4. Although 
considered highly unlikely, RSRM nozzle burn through failures could occur when hot exhaust gases 
passing through the nozzle char and erode the forward exit cone / aft exit cone joint, leading to a failure of 
the two-piece nozzle at joint number 1. The specific failure mode considered for this failure case assumed 
a full circumferential, instantaneous failure of joint 1, which would cause the lower (aft) part of the nozzle 
to be expelled (along with the attachment point for the tilt and rock nozzle actuators). Because the 
actuator attachment point with the nozzle would be eliminated in such a failure, the RSRM motor nozzle 
actuators would not be able to control the direction of the nozzle. The normal nozzle deflection limits of 
±5 degrees would not apply, since the physical constraining mechanism would be lost. Therefore, the 
maximum nozzle deflections for RSRM nozzle burn through failures were limited to ±9.75 degrees, which 
were the physical limits of the nozzle pivot assembly, rather than the normal ±5 degrees of the TVC 
system with no failures. 

In addition to the loss of TVC following a RSRM nozzle burn through failure, the thrust produced was 
reduced by 12.6% as a result of the change in the expansion ratio that would be caused by the expulsion 
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of the lower (aft) part of the nozzle. The engineering judgment of the ATK personnel determined that 
within 4-12 seconds of the nozzle burn through failure, some other secondary failure would occur, which 
would likely lead to the loss of the vehicle (See Reference 4). Therefore, in addition to modeling the 
12.6% reduction in thrust and loss of TVC during RSRM nozzle burn through failures, this failure mode 
implemented a maximum simulation time duration of 12 seconds to terminate the simulation following 
these failures, if the other termination criteria (discussed earlier in this section) had not already been met. 
Figure 3 shows the RSRM thrust resulting from a nozzle burn through failure beginning at 16 seconds, 
compared with the baseline thrust profile. 



Time, seconds 


Figure 3 RSRM Nozzle Burn Through Failure Thrust Profile 


The simulation analysis approach used to evaluate the effects of RSRM nozzle burn through failures 
did not attempt to predict the dynamic deflection of an uncontrolled free-hanging nozzle, once the 
actuator attachment points with the nozzle were lost. Instead, the loss of TVC was modeled by 
maintaining the deflections of the two actuators at fixed positions for the remainder of the trajectory. The 
free-hanging nozzle would be limited to maximum angular deflections of 9.75° from the nozzle centerline 
in any tilt/rock combination due to the presence of the nozzle snubber assembly, which was assumed to 
remain intact after the failure. Given these assumptions and ground rules, the RSRM nozzle burn through 
failures were simulated by evaluating 17 separate simulation cases with the nozzle deflection maintained 
at 8 combinations of tilt and rock that provide 9.75° total deflection, 8 combinations of tilt and rock that 
provide 5° total deflection, and one case with the tilt and rock deflections at zero. The cases with 9.75° or 
5° total deflections include combinations of rock deflection only (positive and negative), tilt deflection only 
(positive and negative) and equal magnitude tilt and rock (positive and negative combinations). These 17 
combinations of tilt and rock deflections were simulated for each failure time in the malfunction turn 
analysis 

RSRM CASE BREACH FAILURE 


RSRM case breach failures were assumed to be the result of a breach, or opening, through the outer 
case of the rocket motor, which would allow exhaust gasses to pass through and to produce thrust 
directed orthogonally to the vehicle axis of symmetry, with a reduction in the thrust and mass flow rate 
produced by the motor nozzle, as well. The Ares l-X vehicle RSRM was assembled with three field joints 
at which the segments of the RSRM were joined together. These field joints were assumed to be the most 
likely location for a case breach failure. In Reference 4, ATK provided a parametric model of the thrust, 
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pressure, and mass flow rate produced at both the nozzle and at the location of a case breach as a 
function of the time that the failure occurred relative to RSRM motor ignition. The radial growth rate of the 
breach was also provided. This allowed calculation of the forces and moments imparted to the vehicle in 
a breach scenario. Figure 4 presents a schematic of the Ares l-X vehicle, with the locations of the three 
RSRM field joints shown. 


Mid field joint 
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Figure 4 RSRM Case Breach Failure locations 


The simulation modeling approach used to implement RSRM case breach failures consisted of a 
series of separate simulation cases for each failure time in which the case breach failure occurred at 
various locations evenly spaced every thirty degrees around the circumference of the outer case of the 
RSRM, and at the axial locations of the forward, mid, and aft field joints illustrated in Figure 4. Figure 5 
presents a typical thrust profile for the thrust produced from the RSRM nozzle and from a case breach at 
the mid joint location corresponding to a case breach failure initiated at 6 seconds after RSRM ignition, 
compared with a normal thrust profile (with no failures). In addition to the reduction in thrust and mass 
flow rate through the nozzle following a RSRM case breach failure and the side thrust produced through 
the breach in the motor case, the engineering judgment of the ATK personnel determined that within 38- 
48 seconds of outboard case breach failures (those on the part of the RSRM away from the Space 
Shuttle vehicle body, for which the analysis was originally performed), some other secondary failure 
would likely occur, leading to the loss of the vehicle (See Reference 4). Therefore, in addition to modeling 
the reduction in nozzle thrust and the side thrust from the breach in the RSRM case, this failure mode 
implemented a maximum simulation time duration of 48 seconds after the onset of the failure, if other 
simulation termination criteria (described earlier in this section) had not already been met. 

SOFTWARE FAILURES AND ANOMALIES 


The Ares l-X LCRSP PRA working group evaluated avionics software failures that could affect the 
vehicle trajectory and attempted to categorize those failures as similar to existing hardware failures, or as 
other failure classes. Several software failure modes were evaluated by the RSTWG to determine if they 
could result in a malfunction turn. The following paragraphs describe the flight software failure modes that 
were determined to result in significant trajectory deviations of the vehicle and these were included in the 
malfunction turn analysis failure run matrix. 

Lock in place, hard over and null TVC command failures caused by flight software failures were 
included in this analysis. The lock in place and null failure scenarios were accounted for in the cases run 
for TVC hardware failures (described earlier), as the vehicle response to these failures are the same for 
hardware or software failures. Software commanded hard over failure scenarios were simulated at the 
software TVC deflection command limits. Per the Ares l-X flight control software design, there were two 
software TVC deflection command limit levels: prior to clearing the launch tower (at approximately 5-6 
seconds after launch), the software TVC deflection command was limited to ±2 degrees total deflection 
(rock and tilt combined); and, after the launch tower was cleared, the software TVC deflection command 
was limited to ±4 degrees total deflection (rock and tilt combined). Software commanded hard over TVC 
command failures were modeled in a manner similar to the deflections used in the RSRM nozzle joint 1 
failure. That is, at each failure time, eight different simulation cases were run, in which the appropriate 
software TVC command deflection limit of 2 or 4 degrees was individually applied to the rock and tilt axes 
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with all deflection applied to the rock or tilt axis (plus and minus magnitude with the other axis command 
zero) and another series of runs with equal magnitudes of rock and tilt axis deflection commands (each 
axis plus and minus value of the limit multiplied by the sine of 45 degrees). 

Other software failures, not specifically identified but referred to as “other” software failures, were 
assigned a relatively high probability of occurrence. The RSTWG, with the help of the PRA Working 
Group and other experts, evaluated the Ares l-X software and identified potential failure modes that could 
represent the “other” category and cause a malfunction turn (that is, those software failures that would 
result in a significant departure of the vehicle trajectory from its nominal trajectory). These failure modes 
are explained in the following paragraphs. 
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Figure 5 RSRM Case Breach Failure Thrust Profile 


INCORRECT GAIN LOAD SOFTWARE ERRORS 


One class of the “other” software failures represented incorrect software loads of the Ares l-X flight 
control system (FCS) software gains. Most of the FCS gains were scheduled as a function of the fault 
tolerant inertial navigation unit estimated altitude of the vehicle center of mass. Errors in the FCS gain 
schedule loads were simulated by two different methods: the first method involved setting the value of 
FCS gains to zero for the entire trajectory, whereas the second method involved setting the value of the 
FCS gains to zero only at specific altitude break points. Prior analyses of such errors had shown that the 
vehicle trajectory showed relatively little sensitivity to zero gain values for all but six of the FCS gains - 
those used in the FCS pitch and yaw axis proportional-integral-derivative (PID) controller channel that 
provided the stabilization of the Ares l-X flight test vehicle. Each axis of the FCS employed three such 
gains: a proportional gain, an integral gain and a derivative gain. The FCS software employed tables of 
twenty values of each of these gains at twenty values of the estimated altitude. This class of the “other” 
software failures was simulated using 126 total simulation cases in which each of the six PID gains were 
set to zero for the entire trajectory (6 cases), and where the tabulated values of each of the six PID gains 
as a function of estimated altitude have a single entry set to zero (20 cases for each of the 6 PID gains). 
These failure cases did not employ a “failure time” per se, as the other failures use. These failures are 
assumed to be the result of a faulty software load, but time dependence was introduced in 120 of the 126 
cases, where a single PID gain value was set to zero at a specific altitude index in the gain tables. 
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STATIC ALTITUDE ESTIMATE SOFTWARE ERRORS 


Since many of the FCS gains were functions of the estimated altitude, another type of the “other” 
software failures that was considered consists of errors in processing the estimated vehicle altitude from 
the fault tolerant inertial measurement unit. This class of software failures was simulated by holding the 
value of the estimated altitude fixed after the time of the failure, in which the failure initiation time was 
every two seconds from launch until RSRM burnout / staging. This results in 62 different simulation cases 
for this class of software failures. 

INCORRECT FLIGHT AZIMUTH SOFTWARE ERRORS 


This class of the “other” software failures represented errors in the inertial navigation system software 
processing of the vehicle measured angular rates and linear accelerations into its estimates of vehicle 
position, velocity, and orientation relative to the navigator reference frame. The navigator reference 
frame is an inertial frame with its origin at the earth’s center and its axes oriented with an East-North-Up 
local level frame at the Ares l-X vehicle launch pad (pad LC-39B at KSC) at the time of “go inertial” (33 
seconds prior to RSRM ignition. This class of failures was simulated by applying at launch a fixed 
azimuth rotation bias angle about the navigator’s vertical axis to the navigator measured vehicle state 
estimates. 119 cases were simulated with the azimuth bias angle varied from 3 to 357 degrees in 3 
degree increments. These cases were not dependent on a specific failure time, but occurred at time 
zero, since they represent an error in the software, not a “failure” per se. 

SIMULATION MALFUNCTION TURN ANALYSIS APPROACH 


The simulation analysis approach used to evaluate the effects on the Ares l-X vehicle trajectory 
caused by each of the failure modes is described in this section. A matrix of simulation cases was 
created, in which separate simulations of the Ares l-X POST2 6-DOF simulation were made for each of 
the failures considered with the time of failure occurring at different times in the vehicle trajectory, 
beginning at time zero (release of the vehicle hold down mechanism on the launch pad) and every 2 
seconds thereafter, until burnout of the RSRM (which normally occurs at approximately 123 seconds after 
ignition). 

The run matrix resulting from the malfunction turn trajectory analysis of the Ares l-X consisted of 8423 
separate simulation cases. The breakdown of the individual failure modes in the run matrix was as 
follows: Loss of TVC control: 4340 cases (consisting of 248 hard over deflections (2 axes x 2 deflections 
(±5°) x 62 failure times), 868 single axis lock in place (2 axes x 62 failure times x ±3a min/max deflection 
at each failure time), 3038 dual axis lock in place (~50 deflection combinations x 62 failure times), 186 
drift to null (rock axis only, tilt axis only, dual rock and tilt axis (software failures only) x 62 failure times 
each)); RSRM nozzle burn through: 1054 cases (17 deflection sets x 62 failure times); RSRM case 
breach: 2232 cases (12 angular breach positions x 3 longitudinal breach positions x 62 failure times); 
software dual axis hard over TVC failure: 496 cases (8 combinations of rock/tilt deflections x 62 failure 
times); “other” software failures: 301 cases (120 software gain errors, 62 static altitude estimate errors, 
119 navigator azimuth bias errors (3 to 357 degree errors in 3 degree increments, all at time zero). 

The primary output products of the malfunction turn analysis were: a nominal vehicle trajectory file 
containing vehicle trajectory state information from RSRM ignition / vehicle launch pad hold down release 
until normal RSRM burnout without any failures, individual files containing vehicle trajectory state 
information after the onset of each failure case, and an output summary file containing the deviation of the 
vehicle velocity versus time for the first 12 seconds after each failure initiation time for each failure 
considered (or, until the end of the simulation run, as determined by vehicle breakup, ground impact, 
normal RSRM burnout, or other criteria — whichever occurred first). The deviation of the vehicle velocity 
vector caused by the failure was referred to as the velocity turn angle, which was computed as the dot 
product of the vehicle velocity vector after a failure with that of a normally operating vehicle, and 
represents the total angular departure of the vehicle velocity vector caused by the particular failure being 
evaluated. The single output file containing the velocity turn angle time history data for all failure cases 



considered was referred to as the composite turn angle table. The composite turn angle table was used 
by the 45SW along with the vehicle debris catalog and the probability of failure for each failure mode 
established by the PRA, to evaluate the potential risks to facilities or personnel in the KSC launch area 
and to determine the number of expected casualties (E c ) in the event of a flight test vehicle failure. 

Additional information about the malfunction turn analysis approach, ground rules, failure modes, 
outputs, etc. are provided by Reference 5, which was another of the output products of the Ares l-X range 
safety analyses that were delivered to the Range Safety Officer as part of the request for the approval of 
the Ares l-X final flight plan by the 45SW / Eastern Flight Test Range. 

SIMULATION QUALITY ASSURANCE AND INDEPENDENT VERIFICATION & VALIDATION 


To confirm that the simulation predictions of the vehicle response to each of the malfunction turn 
failure modes described in the previous section were correct, an extensive quality assurance and 
independent verification and validation process was conducted. These processes involved the use of a 
separately implemented and maintained 6-DOF simulation of the Ares l-X vehicle developed at JSC: the 
Advanced NASA Technology Architecture for Exploration Studies (ANTARES) simulation, version 7.2.0 in 
addition to the POST2 simulation. The Ares l-X ANTARES simulation predictions of the effects of the 
vehicle failure modes described earlier in this document were compared with those predicted with the 
POST2 6-DOF simulation in two processes. A collection of representative malfunction turn failures was 
developed, and extensive comparisons of simulated vehicle state parameters predicted by the two 
simulations were made for each in this “QA run matrix.” Additionally, a list of required and desired metrics 
were evaluated for each mission, as well as evaluation of time histories of other vehicle state parameters. 
Also, the entire malfunction turn run matrix was performed with each simulation, and the primary outputs 
of each simulated case from that run matrix (the vehicle breakup time, or other final simulated time, and 
the vehicle velocity turn angles) were compared. All required simulation match criteria were met or 
exceeded, and the only parameters which failed to meet the desired match criteria were pitch and yaw 
attitude, and roll rate for a few of the cases. These cases did not significantly exceed the criteria, and 
were determined to be acceptable comparisons. In addition, the comparison of vehicle breakup times (or 
other end of simulation criteria) for the entire malfunction turn analysis run matrix and the composite turn 
angle tables was also determined to be acceptable comparisons. 

Additional information for the QA and IV&V processes used for the Ares l-X malfunction turn range 
safety analysis is provided in Reference 5. 

SAMPLE SIMULATION RESULTS 


As an example of the trajectory dispersions that resulted from the simulation of the 8423 failure modes 
of the Ares l-X malfunction turn analysis, Figure 6 shows an overhead view of Florida and the Atlantic 
Ocean near the KSC launch site, with instantaneous vacuum impact positions of the vehicle resulting 
from only the dual axis TVC in-place failures, and with the nominal vehicle RSRM burnout stage 
separation area shown with the yellow circle. The solid red lines represent the impact limit lines that are 
defined to protect personnel and facilities near the launch area. In another view, which zooms in on the 
area around the launch pad LC-39B at KSC, Figure 7 shows the instantaneous vacuum impact position of 
the vehicle for each of the 8423 cases in the failure run matrix. Each symbol is color coded to represent 
different failure types. Note that the view shown in Figure 7 does not show all of the instantaneous 
vacuum impact points, since it is zoomed in around the launch pad (some IIPs to the right are not shown 
in that view), and in this view, the yellow circle indicates the launch pad LC-39B, instead of the nominal 
vehicle RSRM burnout / stage separation region as shown in the previous figure. 
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Figure 6 IIP Locations for Dual Axis TVC Lock in Place Failures Only 



Figure 7 IIP Locations for All Failure Types (Expanded around Launch Area) 
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SUMMARY AND CONCLUSIONS 


The methodology used to evaluate the effects of failures in the vehicle TVC system, RSRM nozzle 
burn through and case breach, and software failures for the Ares l-X malfunction turn analysis was 
described. The development of the simulation run matrix consisting of a total of 8423 cases that were 
analyzed to evaluate the effects of various failure modes on the Ares l-X flight test vehicle trajectory was 
explained. Also described was the methodology used to generate (and to verify using a separate 6-DOF 
simulation model) the vehicle trajectory state data files and velocity turn angle file (composite turn angle 
table) which were provided to the 45SW for their ensuing range safety analyses for the Ares l-X flight data 
plan approval, and its subsequent successful launch on October 28, 2009. 
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GLOSSARY 


ANTARES = Advanced NASA Technology Architecture for Exploration Studies 
ATK = Alliant TechSystems (a division of ATK Thiokol, Inc.). 

6-DOF = six degrees-of-freedom 

IV&V = Independent verification and validation 

E c = Expected number of casualties 

FCS = Flight control system 

45SW = United States Air Force 45 th Space Wing 

IIP = Instantaneous vacuum impact point 

JSC = Lyndon B. Johnson Space Center (NASA) 

KSC = Kennedy Space Center (NASA) 

LCRSP = Launch Constellation range safety panel 

PID = Proportional, integral, derivative control 

POST2 = Program to optimize simulated trajectories, version II 

PRA = Probabilistic risk assessment 

RSTWG = Range safety trajectory working group 

GA = Guality assurance 

RSRM = Reusable solid rocket motor 

TVC = Thrust vector control 

USAF = United States Air Force 
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